ac0f742b2b137943f549c689a3ec9e6e1c92cab20b5ab971832b3d6dac97eb17

Analysis

max time kernel
151s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
Size 24.5MB
Sample260828-pmqkcsch39
SHA256 ac0f742b2b137943f549c689a3ec9e6e1c92cab20b5ab971832b3d6dac97eb17
MD5 8c93f0a7f0603957928ea9aad3b76c55
SHA1 5eddb85d6bebc35f9d21bd38094825ba8bae22af
SHA512 d42a4760aa05dca11c90f8ddae064c41382e9bee0c788a88359b8c2dce23160042913301a9bdfedd01690ec9a960dd9aa2196b92f62443bfbbdcdb7652d3cfb1
SSDEEP 49152:zudCDvwT4vKKbhWj0wjlktD4a0CfZ1Cy988xJhGnSDJEKHMvtrI72dRt8rfIkat7:pvKKbh6Jta+UUamsrfszizYP1b
TLSH
T119476216B746898BE42A9634844B4FE4E325DCB186B0837733B9371D2FFE34C5EA6215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\CtUfIk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2408	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
440	atkm98.exe
4868	atkm98.exe

Loads dropped DLL 2 IoCs

pid	Process
440	atkm98.exe
4868	atkm98.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\CtUfIk\\atkm98.exe\""	atkm98.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2272	cmd.exe
4628	cmd.exe
5628	cmd.exe
4592	cmd.exe
1948	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	atkm98.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GkuzF9	atkm98.exe
File created	C:\Program Files (x86)\GkuzF9\GkuzF9.exe	atkm98.exe
File created	C:\Program Files (x86)\GkuzF9\XPSPLOG.dll	atkm98.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1524	cmd.exe
4116	cmd.exe
1660	cmd.exe
1200	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1132	schtasks.exe
1148	schtasks.exe
788	schtasks.exe
4576	schtasks.exe
5952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
8	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe
440	atkm98.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeIncreaseQuotaPrivilege	2408	powershell.exe
Token: SeSecurityPrivilege	2408	powershell.exe
Token: SeTakeOwnershipPrivilege	2408	powershell.exe
Token: SeLoadDriverPrivilege	2408	powershell.exe
Token: SeSystemProfilePrivilege	2408	powershell.exe
Token: SeSystemtimePrivilege	2408	powershell.exe
Token: SeProfSingleProcessPrivilege	2408	powershell.exe
Token: SeIncBasePriorityPrivilege	2408	powershell.exe
Token: SeCreatePagefilePrivilege	2408	powershell.exe
Token: SeBackupPrivilege	2408	powershell.exe
Token: SeRestorePrivilege	2408	powershell.exe
Token: SeShutdownPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeSystemEnvironmentPrivilege	2408	powershell.exe
Token: SeRemoteShutdownPrivilege	2408	powershell.exe
Token: SeUndockPrivilege	2408	powershell.exe
Token: SeManageVolumePrivilege	2408	powershell.exe
Token: 33	2408	powershell.exe
Token: 34	2408	powershell.exe
Token: 35	2408	powershell.exe
Token: 36	2408	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 2408	440	atkm98.exe	93
PID 440 wrote to memory of 4628	440	atkm98.exe	95
PID 4628 wrote to memory of 1132	4628	cmd.exe	98
PID 4628 wrote to memory of 5464	4628	cmd.exe	100
PID 440 wrote to memory of 5628	440	atkm98.exe	101
PID 440 wrote to memory of 4592	440	atkm98.exe	105
PID 4628 wrote to memory of 3444	4628	cmd.exe	106
PID 5628 wrote to memory of 1148	5628	cmd.exe	108
PID 4592 wrote to memory of 788	4592	cmd.exe	109
PID 5628 wrote to memory of 2700	5628	cmd.exe	110
PID 4592 wrote to memory of 1476	4592	cmd.exe	111
PID 4592 wrote to memory of 5740	4592	cmd.exe	113
PID 5628 wrote to memory of 1204	5628	cmd.exe	114
PID 440 wrote to memory of 1948	440	atkm98.exe	115
PID 1948 wrote to memory of 4576	1948	cmd.exe	117
PID 1948 wrote to memory of 5964	1948	cmd.exe	118
PID 440 wrote to memory of 2272	440	atkm98.exe	120
PID 1948 wrote to memory of 4584	1948	cmd.exe	122
PID 2272 wrote to memory of 5952	2272	cmd.exe	123
PID 2272 wrote to memory of 2724	2272	cmd.exe	124
PID 2272 wrote to memory of 3248	2272	cmd.exe	126
PID 1660 wrote to memory of 2976	1660	cmd.exe	131
PID 1524 wrote to memory of 2532	1524	cmd.exe	132
PID 4116 wrote to memory of 3008	4116	cmd.exe	133
PID 1200 wrote to memory of 4368	1200	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:8

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4956

C:\Users\Public\CtUfIk\atkm98.exe
"C:\Users\Public\CtUfIk\atkm98.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\CtUfIk\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\CtUfIk\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1148
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5964
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5952
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2724
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3248

C:\Users\Public\CtUfIk\atkm98.exe
"C:\Users\Public\CtUfIk\atkm98.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4868

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\CtUfIk" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\CtUfIk" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2976

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4644

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4368

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2532

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 4fa1d5d0211f14816007c0dccf135eb21200ca13a49bcc2b284a0c88d9e67aa2
MD5 d54ee47350c95b3c2ae9fc285881a2dd
SHA1 4f5f85e8cd9092f0118dfc2f1b095501a37a1dff
SHA512 7578590c46de8afd83107f6d0ad8a11fc842ac117b079d95c6d7597191faa59337eaa3654711fb58d303e12325b71481e06d40d81393d5999dcbc85b401600e4
TLSH
T1B3C04C9067B54254F1358E7E2F61166297765D159912C7540B64434DC4A9A411872E13
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\CtUfIk\UxEnhance64.dll
Size 3.1MB
SHA256 5e21c3f1fab9fa1e6148a369a5f7a5282efea3de081818aebe68b8e52c1a9f3e
MD5 90d4cdcb72c17aa2e8bfe528563ee74b
SHA1 ee7e7745b18aebef901b614e620acafac6751589
SHA512 28f19500a1d799f15ece0d830ab8e6bfe3237adb50352a8175b2f0220f0e18d6566cb3ef886f59340956b86b99495a6f3cb6a897ece4a6c83f1c259966d5bea5
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+X:P9m29xx3Tiqt06ox6+z2rNNrKoX
TLSH
T16EE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\CtUfIk\adoresd.dat
Size 4.7MB
SHA256 af004b666e975d34b79f0d95841b4a447ebfba1820b4bcf4ac36fdcd37a303bc
MD5 5e1d483ca7806b53c42974864c97827f
SHA1 37f2eaf09dd8e935d95c5b10d1dad17705e134dd
SHA512 58f6bb9dacf23a2b57f4330bc933dffd663a78a1687e136f119efcf1e618b1caabe024adb39d3646d26a15aa7f19dca8f89dc64ee101a16689124a11e3ce9291
SSDEEP 98304:uKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:uKClqhi0Cv54K2IVS0VQg
TLSH
T1F83633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atkm98.exe

Path C:\Users\Public\CtUfIk\atkm98.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\CtUfIk\msadox.tb
Size 8KB
SHA256 3177e688d03364d3cd756350b65cd17ec4906672019e1837963a2d3e40858358
MD5 636ecd935edde8758d1ddf813ede363e
SHA1 40f432101ca95e9f60c531857d03fa4372b6985c
SHA512 0de006bf2e7a6268489e37322b864d8ac6ce22b240591f495070c0000e0605749f3fca7264877e64257550cff9be0c2773cde5a2baef6def31ae4e994ec07675
SSDEEP 192:NqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:NsZqZOXQ3uqvR2Kfzp
TLSH
T17A029E05D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/8-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/8-2-0x00000000007B0000-0x00000000007BC000-memory.dmp

Download

memory/8-504-0x00007FFF5E590000-0x00007FFF5E5A2000-memory.dmp

Download

memory/8-526-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/8-527-0x00007FFF5E590000-0x00007FFF5E5A2000-memory.dmp

Download

memory/440-561-0x0000027D148A0000-0x0000027D1492A000-memory.dmp

Download

memory/440-570-0x0000027D14010000-0x0000027D14897000-memory.dmp

Download

memory/440-542-0x0000027D14010000-0x0000027D14897000-memory.dmp

Download

memory/440-546-0x0000027D14010000-0x0000027D14897000-memory.dmp

Download

memory/440-547-0x0000027D14010000-0x0000027D14897000-memory.dmp

Download

memory/440-549-0x0000027D14010000-0x0000027D14897000-memory.dmp

Download

memory/440-548-0x0000027D14010000-0x0000027D14897000-memory.dmp

Download

memory/440-553-0x0000027D14010000-0x0000027D14897000-memory.dmp

Download

memory/440-539-0x0000027D14010000-0x0000027D14897000-memory.dmp

Download

memory/440-562-0x0000027D148A0000-0x0000027D1492A000-memory.dmp

Download

memory/440-564-0x0000027D148A0000-0x0000027D1492A000-memory.dmp

Download

memory/440-560-0x0000027D148A0000-0x0000027D1492A000-memory.dmp

Download

memory/440-559-0x0000027D11DA0000-0x0000027D11DEE000-memory.dmp

Download

memory/440-567-0x0000027D14010000-0x0000027D14897000-memory.dmp

Download

memory/440-569-0x0000027D14010000-0x0000027D14897000-memory.dmp

Download

memory/440-541-0x00007FFF66640000-0x00007FFF66642000-memory.dmp

Download

memory/440-533-0x00007FFF66630000-0x00007FFF66632000-memory.dmp

Download

memory/440-534-0x00007FFF43660000-0x00007FFF43B7E000-memory.dmp

Download

memory/2408-604-0x000001D79AD10000-0x000001D79AD32000-memory.dmp

Download

memory/2408-610-0x000001D7B3330000-0x000001D7B333A000-memory.dmp

Download

memory/2408-608-0x000001D7B35A0000-0x000001D7B3652000-memory.dmp

Download

memory/2408-607-0x000001D7B3350000-0x000001D7B336E000-memory.dmp

Download

memory/4868-590-0x0000023F3A420000-0x0000023F3ACA7000-memory.dmp

Download

memory/4868-589-0x0000023F3A420000-0x0000023F3ACA7000-memory.dmp

Download

memory/4868-588-0x0000023F3A420000-0x0000023F3ACA7000-memory.dmp

Download

memory/4868-585-0x0000023F3A420000-0x0000023F3ACA7000-memory.dmp

Download

memory/4868-583-0x00007FFF66640000-0x00007FFF66642000-memory.dmp

Download

memory/4868-591-0x0000023F3A420000-0x0000023F3ACA7000-memory.dmp

Download

memory/4868-579-0x0000023F3A420000-0x0000023F3ACA7000-memory.dmp

Download

memory/4868-592-0x00007FFF66630000-0x00007FFF66632000-memory.dmp

Download

memory/4868-577-0x00007FFF43660000-0x00007FFF43B7E000-memory.dmp

Download